USN-7496-4: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Block layer subsystem; - Character device driver; - Hardware crypto device drivers; - GPU drivers; - Media drivers;...

CVE-2025-20967

Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Android 14 allows attackers to read and write arbitrary file with the privilege of Samsung Gallery...

CVE-2025-20980

Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption...

CVE-2025-20979

Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code...

CVE-2025-20977

Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get sensitive information. User interaction is required for triggering this vulnerability...

CVE-2025-20974

Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to bypass user interaction for requested installation...

CVE-2025-20970

Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackers to access image files with Bixby Vision privilege...

CVE-2025-20969

CVE-2025-20969 affects Samsung Gallery: improper input validation allows a local attacker to access data within the app. Affected versions are pre-14.5.10.3 (Global Android 13), pre-14.5.09.3 (China Android 13), and pre-15.5.04.5 (Android 14). Remediation: update to 14.5.10.3+/14.5.09.3+/15.5.04....

CVE-2025-20957

Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch arbitrary activities with SmartManagerCN privilege...

CVE-2025-20949

The CVE-2025-20949 entry concerns Samsung Members with a path traversal vulnerability affecting versions prior to 5.0.00.11. Reported data describe an issue where an attacker could read and write arbitrary files using the privilege of Samsung Members, due to improper filtering of path elements. S...

CVE-2025-32399

creationtimestamp| type| source ---|---|--- 2025-05-07 07:22:05+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15276 2025-05-07 08:26:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokxylhe322h 2025-05-07 10:34:35+00:00| seen| https://t.me/cvedetector/24685...

CVE-2025-32401

creationtimestamp| type| source ---|---|--- 2025-05-07 07:22:03+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15274 2025-05-07 08:26:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokxylrevc2p 2025-05-07 10:34:12+00:00| seen| https://t.me/cvedetector/24676...

CVE-2025-32404

An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the library by sending a malicious RPC packet...

CVE-2025-32405

An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet...

CVE-2025-3766

creationtimestamp| type| source ---|---|--- 2025-05-07 05:21:49+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15269 2025-05-07 08:26:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokxyklrhm2w 2025-05-07 08:53:11+00:00| seen|...

CVE-2025-3852

The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.0 to 2.6.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email & password through the update function. This makes i...

CVE-2025-3851

creationtimestamp| type| source ---|---|--- 2025-05-07 02:21:40+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15247 2025-05-07 04:26:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokkl3pbb22p 2025-05-07 07:12:57+00:00| seen|...

CVE-2025-3844

creationtimestamp| type| source ---|---|--- 2025-05-07 02:21:39+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15246 2025-05-07 04:26:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokkl2n3wi2w 2025-05-07 05:31:29+00:00| seen|...

CVE-2025-0649

creationtimestamp| type| source ---|---|--- 2025-05-06 21:16:37+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114462962265876830 2025-05-06 22:27:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lojwintqaq24 2025-05-07 00:14:11+00:00| seen|...

CVE-2025-47419

Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue affects Automate VX: from...